ci: Upgrade to JDK 21 and centralize CI configuration with new workflows (#4948)

.github/actions/gradle-setup/action.yml

@@ -0,0 +1,35 @@
+name: Gradle Setup
+description: Setup Java and Gradle for KMP builds
+inputs:
+  cache_read_only:
+    description: 'Whether Gradle cache is read-only'
+    default: 'true'
+  jdk_distribution:
+    description: 'JDK distribution (temurin or jetbrains)'
+    default: 'temurin'
+  gradle_encryption_key:
+    description: 'Encryption key for Gradle remote cache'
+    required: false
+runs:
+  using: composite
+  steps:
+    - name: Validate Gradle Wrapper
+      uses: gradle/actions/wrapper-validation@v6
+
+    - name: Set up JDK 21
+      uses: actions/setup-java@v5
+      with:
+        java-version: '21'
+        distribution: ${{ inputs.jdk_distribution }}
+        token: ${{ github.token }}
+
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v6
+      with:
+        cache-read-only: ${{ inputs.cache_read_only }}
+        cache-encryption-key: ${{ inputs.gradle_encryption_key }}
+        cache-cleanup: on-success
+        build-scan-publish: true
+        build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
+        build-scan-terms-of-use-agree: 'yes'
+        add-job-summary: always

.github/copilot-instructions.md

@@ -8,7 +8,7 @@ For execution-focused recipes, see `docs/agent-playbooks/README.md`.
 Meshtastic-Android is a Kotlin Multiplatform (KMP) application for off-grid, decentralized mesh networks. The goal is to decouple business logic from the Android framework, enabling future expansion to iOS and other platforms while maintaining a high-performance native Android experience.
 
 - **Language:** Kotlin (primary), AIDL.
-- **Build System:** Gradle (Kotlin DSL). JDK 17 is REQUIRED.
+- **Build System:** Gradle (Kotlin DSL). JDK 21 is REQUIRED.
 - **Target SDK:** API 36. Min SDK: API 26 (Android 8.0).
 - **Flavors:**
   - `fdroid`: Open source only, no tracking/analytics.
@@ -99,7 +99,7 @@ Meshtastic-Android is a Kotlin Multiplatform (KMP) application for off-grid, dec
 ## 4. Execution Protocol
 
 ### A. Environment Setup
-1. **JDK 17 MUST be used** to prevent Gradle sync/build failures.
+1. **JDK 21 MUST be used** to prevent Gradle sync/build failures.
 2. **Secrets:** You must copy `secrets.defaults.properties` to `local.properties`:
    ```properties
    MAPS_API_KEY=dummy_key
@@ -128,7 +128,7 @@ Always run commands in the following order to ensure reliability. Do not attempt
 ./gradlew testFdroidDebug testGoogleDebug # Flavor-specific unit tests
 ./gradlew lintFdroidDebug lintGoogleDebug # Flavor-specific lint checks
 ```
-*Note: If testing Compose UI on the JVM (Robolectric) with Java 17, pin your tests to `@Config(sdk = [34])` to avoid SDK 35 compatibility crashes.*
+*Note: If testing Compose UI on the JVM (Robolectric) with Java 21, pin your tests to `@Config(sdk = [34])` to avoid SDK 35 compatibility crashes.*
 
 **CI workflow conventions (GitHub Actions):**
 - Reusable CI is split into a host job and an Android matrix job in `.github/workflows/reusable-check.yml`.
@@ -154,6 +154,6 @@ Update documentation continuously as part of the same change. If you modify arch
 ## 5. Troubleshooting
 -   **Build Failures:** Check `gradle/libs.versions.toml` for dependency conflicts.
 -   **Missing Secrets:** Check `local.properties`.
--   **JDK Version:** JDK 17 is required.
+-   **JDK Version:** JDK 21 is required.
 -   **Configuration Cache:** Add `--no-configuration-cache` flag if cache-related issues persist.
 -   **Koin Injection Failures:** Verify the KMP component is included in `app` root module wiring (`AppKoinModule`).

.github/workflows/codeql.yml

@@ -70,7 +70,7 @@ jobs:
       uses: actions/setup-java@v5
       with:
         distribution: 'temurin' # See 'Supported distributions' for available options
-        java-version: '17'
+        java-version: '21'
         token: ${{ github.token }}
 
     # Initializes the CodeQL tools for scanning.

.github/workflows/dependency-submission.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-java@v5
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
           token: ${{ github.token }}
 
       - name: Generate and submit dependency graph

.github/workflows/docs.yml

@@ -47,15 +47,10 @@ jobs:
           submodules: 'recursive'
           ref: ${{ inputs.ref || '' }}
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Build Dokka HTML documentation
         run: ./gradlew dokkaGeneratePublicationHtml

.github/workflows/publish-core.yml

@@ -23,19 +23,10 @@ jobs:
         with:
           submodules: 'recursive'
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Configure Version
         id: version

.github/workflows/release.yml

@@ -125,19 +125,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Load secrets
         env:
@@ -222,19 +215,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Load secrets
         env:
@@ -294,21 +280,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-          
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Install dependencies for AppImage
         if: runner.os == 'Linux'

.github/workflows/reusable-check.yml

@@ -58,6 +58,8 @@ jobs:
     permissions:
       contents: read
     timeout-minutes: 60
+    outputs:
+      cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
 
     steps:
       - name: Checkout code
@@ -66,26 +68,21 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
 
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v6
+      - name: Determine cache read-only setting
+        id: cache_config
+        shell: bash
+        run: |
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]] || [[ "${{ github.event_name }}" == "merge_group" ]] || [[ "${{ github.ref }}" == gh-readonly-queue/* ]]; then
+            echo "cache_read_only=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "cache_read_only=true" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.event_name != 'merge_group' && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          cache-cleanup: on-success
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
 
       - name: Code Style & Static Analysis
         if: inputs.run_lint == true
@@ -138,6 +135,7 @@ jobs:
     permissions:
       contents: read
     timeout-minutes: 60
+    needs: host-check
     strategy:
       fail-fast: true
       matrix:
@@ -150,26 +148,11 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
 
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.event_name != 'merge_group' && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          cache-cleanup: on-success
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ needs.host-check.outputs.cache_read_only }}
 
       - name: Determine matrix metadata
         id: matrix_meta
@@ -266,3 +249,35 @@ jobs:
             **/build/outputs/androidTest-results
           retention-days: 7
           if-no-files-found: ignore
+
+  build-desktop:
+    name: Build Desktop Debug
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 60
+    needs: host-check
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: 'recursive'
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
+        with:
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ needs.host-check.outputs.cache_read_only }}
+
+      - name: Build Desktop
+        run: ./gradlew :desktop:packageDistributionForCurrentOS -Pci=true --scan
+
+      - name: Upload Desktop artifact
+        if: ${{ inputs.upload_artifacts }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: desktop-app
+          path: desktop/build/compose/binaries/main/app/Meshtastic/bin/*
+          retention-days: 7

.github/workflows/scheduled-updates.yml

@@ -81,21 +81,11 @@ jobs:
       - name: Fix file permissions
         run: sudo chown -R $USER:$USER .
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Update Graphs
         run: ./gradlew graphUpdate